Security — entry 029 of 30

URLhaus

Verified Jul 2026

URLhaus, part of the abuse.ch project run out of Bern, Switzerland, crowdsources and publishes malware-distribution URLs so security teams and blocklist maintainers can flag or block them before they're weaponized further. The community API covers both querying (recent submissions, per-URL/host/payload lookups) and submitting new malicious URLs, with results also available as CSV dumps, MISP events, and Suricata/Snort rulesets for direct feed ingestion. Since 2023 every request needs a free Auth-Key from the abuse.ch Authentication Portal; a paid tier layers on higher reliability and a unified query language across abuse.ch's other feeds.

threat-intelmalwareurl-blocklistiocsecurity
AuthenticationAPI KeySign up with the provider to obtain credentials.
HTTPSSupportedTraffic is encrypted in transit.
CORSDisabledBrowser calls need a server-side proxy.
PricingFreemiumA usable free tier exists, with paid plans for more volume.
FormatsJSON, CSVResponses can be requested as JSON or CSV.

GreatAPIs Score

Score67out of 100
Authentication15/25API key required
Pricing17/20Freemium tier available
Docs0/20No docs or spec available
Formats15/15Supports 2 response formats
Freshness20/20Verified within 6 months

Embed this badge

Scored 67 on greatapis.com
<a href="https://greatapis.com/api/urlhaus-security/"><img src="https://greatapis.com/badge/urlhaus-security.svg" alt="Scored 67 on greatapis.com"></a>

Auth quickstart

  1. Sign up with the provider to get an API key.
  2. Send it on every request as a headerAuthorization: <key>
  3. The exact header isn't documented — Authorization is a common default; confirm in the provider's docs.
Stored keyNo key stored

Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.